TSYS Group COO
04ece5234a
Security:
- Container now runs as non-root user 'provision' (CMMC/STIG audit
requirement). Root execution would fail security audits.
- BW state persisted in named volume at /home/provision/.config/
Bitwarden CLI to avoid slow re-auth on every run.
SSO refactoring:
- cloudron_panel_login(): establishes Cloudron panel session once,
shared across all subsequent app SSO flows
- sso_login(): clicks app-specific SSO/OAuth button, handles Cloudron
OIDC login + consent redirect, properly detects failures
- Detects "You do not have access" OIDC rejections (access control
issue, not a selector bug)
- Per-app SSO button selectors passed as parameters for extensibility
to future Cloudron apps (Dolibarr, Paperless, Firefly, etc.)
Debug:
- _debug_dump() captures screenshot + DOM at failure points
- Added dumps at Gitea token, Redmine key, and SSO failure locations
Current blocker: vp-techops Cloudron user not yet granted access to
Gitea/Redmine/Discourse apps. Cloudron 2FA confirmation pending.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Agent Identity Provisioning
Playwright-based automation for provisioning AI agent identities across the TSYS Group stack: Cloudron enrollment (with 2FA), SSO login, API key generation, and Bitwarden credential storage.
Overview
Each AI agent (VP TechOps, VP SecOps, etc.) gets:
- A dedicated Cloudron user (identity root — SSO provisions everywhere)
- TOTP 2FA enrolled and stored in Bitwarden
- API keys generated in Gitea, Discourse, Redmine (stored in Bitwarden)
- All credentials owned by the agent, sourced via
bw-run.sh(no~/.creds/files)
See ~/Q3/agent-identity-bootstrap.md for the full architecture.
Usage
# 1. Create the manifest from the example
cp agents.yaml.example agents.yaml
# Edit: add Cloudron invite links for each agent
# 2. Set BW credentials
export BW_CLIENTID="..."
export BW_CLIENTSECRET="..."
# 3. Build and run
docker compose up --build
# Or run a single agent
docker compose run --rm provision --agent vp-techops
Manifest format
See agents.yaml.example. Each agent defines:
- Cloudron invite link
- Display name
- Priority (Q3 vs Q4)
- System scopes (Redmine projects, Gitea orgs, Discourse categories)